This year there will be more than 1000 Resorts using RFID enabled ski passes to access their lifts. The vast majority are basic systems of lift entry that keep user information anonymous. Some include RFID payment systems, which are not anonymous. There is a growing trend of Harvesting and aggregating (non-anonymous) data. Some areas such as the Vail Resorts have incentive and tracking programs such as EpicMix in which you can win digital “pins” as you reach certain achievements. For some people that enhances the ski and ride experience, for many others it makes no difference, and the vast majority don’t even know about it. Yet, whether you know about it or not ALL skiers and riders are being tracked and cataloged around the mountain. And most areas using RFID have some time type of data storage systems for their “gamers”. When getting your pass with your name and info attached to it, check to see which “Resort Partners” will also gain assess to your information. Pay special attention to resorts with affiliations with Insurance companies and Financial Services companies. Your information WILL be aggregated and compiled into a digital dossier. This is no longer just science fiction.

We at Ski Pass Defender saw this trend starting more than 5 years ago. We wanted to enable the skiers and riders to be able to control how much information and access to their payment information accessible via the unsecured technology that is RFID. Simply sliding your pass into the Ski Pass Defender allows you to open your pass for reading or block it so that others cannot access it. It is simple, lightweight, and effective. You can still participate in incentive programs as you wish. Yet have security from skimming, scamming, and scanning of your information.

So as you watch the above videos the trends are toward more Gaming of the people. Once educated, then make informed decisions and maintain control of your personal information.

Las Vegas- Consumers should be aware that criminals can steal your credit card, debit card, passport and other valuable information without even touching your wallet or purse. This crime is referred to as “electronic pickpocketing”. The technology used to perform this type of theft is called radio frequency identification or “RFID”.

Hundreds of millions of credit cards, debit cards and all passports issued since 2006 are embedded with a radio frequency identification chip—or RFID. RFID chips are also commonly used in hotel keys, cards that raise gates in parking garages and unlock doors at businesses. Government, military and port of entry ID cards are also vulnerable to this type of theft. You need only swipe the card in front of a reader. The RFID chip is always on, making consumers more susceptible to identity theft.

Thieves can steal this information by using a frequency reader. These readers are inexpensive and easy to obtain. The thief can simply walk next to you and acquire your credit card number and expiration date without any physical contact. While these cards are in your wallet or purse they can transmit your card or passport number and in some states, your digital drivers’ license information when placed near a reader. The information almost immediately appears on a computer screen without you ever knowing about it. Apparently U.S. passports are more difficult to read than cards with RFID chips because they require a password. However, hackers with enough knowledge can see everything on the passport’s front page. A thief can be long gone before the consumer ever realizes his information has been stolen. This is “electronic pickpocketing”.

The credit card industry and the U.S. Department of State use RFID chip technology because it holds more data than magnetic strips and can be read quicker. However, the convenience can also put consumers at risk of having their information stolen. For instance, instead of swiping these cards, they can simply be tapped or passed by a sensor/reader to complete the transaction. This makes paying faster and easier. It is reported that scanned information transferred onto hotel keys has also been read and used to make purchases.

It is important for consumers to protect themselves from this type of identity theft. While the makers of RFID cards say they are safe, consumers need to learn how to prevent this electronic theft from occurring. You can tell if your credit or debit card has the RFID chip by the four wavy lines on the front or some other symbol that indicates they transmit. If your debit card has an RFID chip, most banks are happy to exchange it for a card without the RFID chip. If you have credit cards or a drivers’ license with the RFID chip, contact the issuer to provide a secure sleeve and keep your card inside the sleeve at all times when you are not using it. Other forms of protection are to place the cards in protective sleeves often made of foil or possibly even tin foil or special badge holders that prevent RFID cards from being read unknowingly.

If you would like further information, please call the Attorney General’s Office in Las Vegas at (702) 486-3420 or in Carson City at (7750 684-1180. Consumer protection information can also be found on the Attorney General’s website at www.ag.state.nv.us, the Nevada Fight Fraud website at www.fightfaud.gov, and at the Federal Trade Commission website at www.ftc.gov.

Ski Pass Defender offers an entire line of RFID Blocking products to protect you and your family for becoming a victim to Electronic Pickpocketing.

We have found that ID protection begins with a company focus of helping customer/consumer/user educate themselves to the risks. With proper user awareness initiatives incorporating RFID, social media, and customer usage can be a relatively safe, fun, and useful. Unfortunately marketing programs such as “Broomfield Resort’s” Epicmix creates serious concerns, and their reckless promotion of the program is what we find alarming. We don’t believe that the these companies can or should police themselves.

The purpose of this post is to let you know about the “Database You”, and how it has been created without your knowledge or permission.  Before I expand on the topic, be aware of the language spewed from PR departments to make you overlook the obvious.

Here are a few notable Privacy Breaches:

CBS News resports on Facebook -

General Breach

sexual orientation

December 31, 2011 Summit Daily Article -

Epicmix has users wanting more

In the case of Epicmix and your usage tracking, rather than informing its users of safe online practices, VR’s company policy has been to tell the users that there are “no privacy concerns”. The are mostly likely referencing their data handling policies and having them fall within their “Privacy Policy”. This stance is disingenuous at the very least as it is self-serving for the corporation which permits open usage data sharing with its partners. It is potentially damaging to the end user as data aggregation services using “public” and “user-shared” data continue to proliferate. When a user submits their “accomplishments” on social media sites such as Facebook and Twitter the data is now in the public domain ready to be data-mined. And as this “Public” information is merged with “private” database information which can be acquired through “affiliate or partner” agreements, comprehensive Heuristic Models are created and used by companies which maintain these models. Perhaps you are aware of this, and you are “OK” with it. And that is fine. But if you are not good with this, then you can email VR – commentsvailresortscom and ask NOT to have your data shared with their Partners.

Your data is out there. It happens globally.

You may not have heard of:    The Database You – 2006 Database you.ppt

You may download and keep the “Database You” attachment. I created these slides in 2006 for presentation around the US. Since that time we have seen the advent of Facebook and other social media sites in which an incredible amount of information is freely given, this has filled in the blanks for the database of “YOU”.

For a simple example of the Database You, go to www.Spokeo.com a new online USA phone book w/personal info: pics you’ve posted on FB or web, your approx credit score, home value, income, age, etc. You can remove yourself! Search for yourself on their site (don’t buy the access) , copy that URL of your page,and then go to the bottom of the page and click on the PRIVACY button to remove yourself. Copy & repost so your friends are aware. Also, for a more comprehensive list of these Online Data Brokers, you may visit the Privacy Rights Clearinghouse for more information.

Spokeo.com is only one of more than a hundred public sites which do this type of data aggregation. Private databases are even more numerous and comprehensive. The fact is the more information that is out on the web and stored in servers, the more your personal data and privacy is at risk. It is not just about how many vertical feet your skied or how many days you skied. And if you want to track it, fine. But be informed about the pitfalls of freely providing the your specific information and habits.

Your information CAN and WILL be used against you in some form. e.g. Increase in health insurance rates for the top Vertical feet “winners” on Epicmix by rewarding their “risky behavior”. User specific “Spear-phishing” emails sent to you from “friend look-a-likes” which can contain many types of malware. Or becoming a target of a theft ring, by posting something like “I can’t wait to take the entire family to Vail for the weekend”.

SPEAR-PHISHING -

The more specific information you give, the easier it is to create a method someone else profiting from you. Beware of being one of the Sheep. Protect your data where you can, and take it upon yourself to become educated. Because “Broomfield Resorts” and many of the corporations have their best interests in mind, not yours. We use SkiPassDefender to limit the amount of usage data we provide, and to shield our unique pass information. It is simple to use, and still allows the user to fully use Epicmix or a similar program like it, if YOU choose to do so.

With regard to taking time by trying to protect your information by shielding RFID passes, Breckenridge spokeswoman Kristen Petitt says there is little point.

“We’ve been tracking people and collecting information about them anyway for years,” she said with a wry smile. “With EpicMix, we just finally let you see that information.”

Jonathan Lawson has been an expert in the field of Identity Theft Risk Management since 2005.  Mr. Lawson has held dozens of education seminars for minors, adults, and seniors regarding identity theft and risk mitigation. Breckenridge Instructor since 1993, and former Keystone Golf Professional. Staff Trainer Vail Resorts until 2010.

Initial skimming and cloning of an individual’s ski pass can easily be done now. Even a “Web ID” or “Socket Key” used on passes currently offers value to hackers and skimmers. A privacy policy which allows companies to freely share a users/guest data is really no “privacy policy” at all, especially when it allows their 3rd party affiliates to use the information as they see fit. And it is silly for a person to think that a resort will not leverage this information beyond simply mountain operations.

Finally, to the readers of the ESPN article, Ms. Kelly Ladyga’s comments at the end of the article do NOT accurately reflect the dealings between Vail Resorts and me. In true VPof Communications fashion, Ms. Ladyga tries to spin as defamation, rather than what I was told by Breckenridge’s COO – Pat Campbell, ‘Your business conflicts with our on-going RFID initiative, and you must choose to cease your business and work for us after signing a code of conduct agreement, or keep your business and not continue to work for Vail Resorts” But I guess that would not read as well, so they imply that I lied. Shame on you Vail Resorts, and shame on your Machiavellian ways in communicating with the public.

“We cannot comment on any personnel matters,” Ladyga said. “But Vail Resorts will not permit its employees from purposefully [and] publicly spreading inaccurate, false information on the company or its products or activities.”

NOTHING that I have said prior to my decision to not return to Breckenridge for my 18th season, or after have been inaccurate or false.

Enjoy the read. I believe that individuals should have the right to determine what information can be taken and collected on you, especially during your free and recreational time. Just because they frame it as a game and tell you that they have your privacy or best interests in mind, you should be rightfully aware of data collection and its risks to your personal privacy.

Some enjoy the mountains for the freedom they provide

Skiers and riders have discretionary income and discretionary leisure time. Those two assets are extremely valuable to marketers. However, many people I have spoken with regard to tracking and data collection seem to have little knowledge about the subject. Many people think, “Who would want to know about me?”, and “I don’t care if they know about me or not. I don’t have anything to hide.”

The fact is there are data mining companies, and departments of corporations who piece together data from a number of different sources so that they can better market to you. They also supply data to those who use it to account for your likes, dislikes, activities, and habits.

The direct marketing may be welcomed by some, but also be a nuisance to many. And it can be costly to some. It is a common practice for corporations who generate this data to “share” it with their affiliates as outlined in their privacy policies. And these affiliates can then share it or sell it to their affiliates or other companies who can aggregate the data. And the sharing continues.

Raw skier usage data to marketing knowledge

In fact, there is little that is private about your “private” data. If one of these affiliates happens to be my medical or life insurance company, I would prefer not to have them make judgments about my skiing of black and double black diamond runs all day long. An actuary’s calculations would show that my risk for injury increases, thereby my medical or life insurance could increase. I am sure the insurance company would like to know this information to assist in setting my premiums. This is an unintended, but very real use of data mining on the mountain.

It is only a matter of time until we see RFID or GPS (phone apps) speed zones created on the mountain, there may be other unintended consequences with offering data through affiliate partners. Which company or industry many gain benefit from knowing that I like to go faster than the average skier on the mountain?

I prefer to shield my data with a Ski Pass Defender. I can use my pass as a ski pass when boarding a base lift. I don’t need to share my whereabouts or personal pass information if I choose not to. A number of handheld devices are being created to read RFID from ID cards and passes. And with more than 700 ski areas worldwide using RFID, there will be many different versions of privacy policies, affiliate relationships, and a significant potential for data breach.

Easy Squeeze to Read technology. Allows the pass to read through clothing

ACTUAL PRIVACY POLICY

Here is an actual section of a major resort’s “Privacy Policy” which states how data is shared with 3rd parties.  Did you read this when you bought your pass? This is considered an “Automatic Opt-In”, and it requires you to know that you need to opt-out.

Third-Party Relationships

In order to optimize your experience on our sites, THE RESORT maintains relationships with many corporate partners and service providers throughout the world. If you have any questions about whether certain information, content or services pertain to us, or are provided by one of our partners, please contact us at XYZ.com  (commentsvailresortscom)  .

Whenever you provide registration information on certain Web pages or for certain services provided in conjunction with third party partners, we want to be clear that some data you provide is shared with partners. For instance, certain information is shared with ZZZ.com, our provider of online reservation service. You should make every effort to read the privacy policies provided by or in association with such third parties, and make an informed decision on your own whether or not to continue utilizing the services based upon the privacy policies posted on these Web pages, at your own discretion. However, we will make every effort to ensure that you have the ability to opt-out of the sharing of such data with partners.

Security

XYZ company operates secure data networks protected by industry standard firewall and password protection. XYZ corp has security measures in place to attempt to protect against the loss, misuse and alteration of your user data under our control. While we cannot guarantee that loss, misuse or alteration to data will not occur, we make every reasonable effort to prevent such unfortunate occurrences.

With regard to taking time by trying to protect your information by shielding RFID passes, Breckenridge spokeswoman Kristen Petitt says there is little point.

“We’ve been tracking people and collecting information about them anyway for years,” she said with a wry smile. “With EpicMix, we just finally let you see that information.”

My intention with this post is to let the reader know how important it is to understand you right to protect your information that is collected by companies. Information can help companies better serve you, although there is information that you do not need to share. It should be your choice to opt-in or opt-out.

Jonathan Lawson has been an expert in the field of Identity Theft Risk Management since 2005, and a ski professional since 1991.  Mr. Lawson has held dozens of education seminars for minors, adults, seniors, and corporations regarding identity theft and risk mitigation.

Squeezed to read, release to ride technology

Aspen Ski Company announced the new “Resort Charge” feature for their ski passes. We originally caught wind of this in a Computer World December, 2009. This is when we came up for the need of Ski Pass Defender.

This post is not meant to be an indictment of AspenSnowmass, but rather information and call to action for skiers and riders using RFID enabled passes.
Taken from the Aspen Snowmass Website:

RESORT CHARGE – CASH FREE, HASSLE FREE!
NEW THIS SEASON, attach a credit card to your season pass and never carry cash on the mountain again. Use your season pass as you would your credit card at Aspen Skiing Company-operated restaurants* and Four-Mountain Sports/D&E locations. This plus hands-free gate access gives you the ultimate hassle-free experience!

The RFID enabled ski pass will mostly likely have a “Socket Key” code which is a unique ID. It is now also contained on the RF chip laminated within the pass.

Sample Ski Pass of a Socket Key "WebID"

This number can be cloned, and it just makes sense to shield your RFID information from would be “Skimmers”

This ID code will tell the computer system who you are, and what your privileges include. RF will continue to serve a number of purposes for the ski resorts:

1) Convenience as a RF enabled lift pass

2) Convenience to charge at authorized locations (mainly company operated)

3) Trackable around the mountain (where RF scanners are placed).

Notice that large financial firms do not want to show you about their security measures when tested by an “un-sponsored: 3rd party source:

A ski resort desires is to add convenience, generate profit, and gain adoption of the product. Don’t forget their largest partners. They would like to get a piece of your usage dollars and information as well. American Express, Aspen and Vail Resorts Official Partner, has been well documented for their customer tracking plans. Look for Insurance company partners soon. As more data gets easier to be pulled from you without your knowledge, you now have a way to protect your data accessible when using RFID with a Ski Pass Defender.

Also, passholders should be aware of security concerns with syphoning of data through mobile apps. The apps are free, and they offer function to the user. But until companies disclose what information they take (including GPS info), and who the information gets shared with (Resort Partners & Affiliate partners) we suggests to stay away from those phone apps.

Jonathan Lawson has been an expert in the field of Identity Theft Risk Management since 2005, and a ski professional since 1991.  Mr. Lawson has held dozens of education seminars for minors, adults, seniors, and corporations regarding identity theft and risk mitigation.

As a company attempts to gather more data, regardless of how benign it seems, there is a greater risk that someone will want to get that information. And if there is direct financial gain tied to it, there is even more risk.

Anytime data is stored, there should be privacy concerns

My thought is that ANYTIME a company holds or gathers information there IS a privacy concern. Regarding a company’s stance on privacy, one of my students stated they should say, “Recognizing privacy is important, we have worked hard to address those concerns by building a range of consumer options into our RFID and Social Media program to give you full control of your personal information.”

The sooner companies accept the fact that privacy and security of information is at least a two party job, then we shall be working from the proper premise.  Even top financial companies have regular breaches of security. Heartland Payment Systems data breach Mastercard and Visa for example: Heartland disclosed Jan 20, 2009 that intruders cracked the system it uses to process 100 million card transactions per month from 175,000 merchants. I would imagine that was a VERY secure system.

Until then these threats are acknowledge and talked about, there are things we can do. I will offer you a non-RFID premise of which to be aware.  When using FACEBOOK, do not friend anyone who isn’t really a friend or verified acquaintance. This is not just for a ski area, this scenario can be easily target for any business which has a strong local following. Here is an example of what can happen.

Here is a scenario relevant to a skier or rider:

A crime ring in the Denver or Salt Lake City area opens a few dozen facebook accts and begins “friending” all of the people who like a business, ski resort, sports team, etc.

Companies want to be "liked" on Facebook

Chances are that a good majority of people are from a nearby metro area. A well established resort may have 50,000 people on Facebook who “Like” the company. The potential new friend (crime ring) writes a nice introduction “Great to have a fellow skier/rider of ‘Snowy Peaks Resort’”.  Let’s say 25% of those people accept the new “friend”. So we have 12,500 people who have friended this crime ring.

Next, the ring is looking for people who are planning a family ski/ride trip “this weekend”. The ring can do a some weekly “research” to find who is going to the mountains, and due to crappy Facebook security I can figure out where the person lives. There are easy free options to gather this data, although a ring can pay $200 a yr for access to programs which can do it more quickly and accurately.

The crime ring also have a few theives on “staff”. On saturday morning, the skier/rider posts, “heading up to the mountains now!”, or just arrived at ‘Snowy Peaks’. Now the burglary begins and guaranteed that nobody is home.

Privacy, what privacy?  ID thieves, are a creative sort. Although the resort did not infringe on any of its privacy policies, this has set a target on guests of “Snowy Peaks”.

I have a significant problem with allowing companies to collect ongoing data from me, especially if they do not recognize these as threats to their guests.

I sent this scenario including actual ways to harvest information to several major ski resorts in Colorado. I am hopeful they will respond with a joint effort of privacy. If there are resorts or businesses which would like to know more, I would be happy to send them a few of these scenarios.

2 potential solutions-

1) The resort can post reminders for people to not accept friends they do not know. Reinforce the message, Privacy is a joint effort between the business and the individual.

2) If the resort uses an application, they can create and promote delayed sending of messages to FB or twitter.  The most conservative settings will be preset, but ongoing management can be set by the guest. Immediate, 4hrs, 8hrs, 24hrs, etc.

Option 2 may create uncertainty in the mind of the thieves, as front range or close proximity skiers/riders often day trip.

Privacy knowledge is powerful. If resorts continue to take the arrogant attitude that there are “No privacy issues” then they are part of the problem.

UPDATE: Fox News just released information that US Governmental Agencies have been “Cyber-friending” people on Facebook and other social media sites.

The Ski Pass Defender is designed to offer the individual the ability to protect access to their RFID stored information. Privacy and security are a joint effort. And Ski Pass Defender costs less than a shared tank of gas.

Jonathan Lawson has been an expert in the field of Identity Theft Risk Management since 2005.  Mr. Lawson has held dozens of education seminars for minors, adults, and seniors regarding identity theft and risk mitigation.

Apple's patent for a RFiD reader in the iPhone

Resorts have been sold these benefits from the RFID vendors. It looks good on paper, but RFiD was designed as an open platform, rather than a secure platform.

As more information comes to light regarding RFiD such as the ability for the iPhone and Android devices to be equipped with RFiD readers will people tolerate it. My thought is yes, many will out of ignorance or indifference. The Ski Pass Defender is not made for them. It is designed for those who like the convenience of RFiD as a lift pass, but prefer to opt-out and/or better protect their privacy.

You won’t have to ask is that an iPhone, or are you just happy to read my RFID?

Here is how easy skimming can be: The Credit Cards are enabled with 13.56Mhz chips, the UHF 900Mhz can be read from longer distances.

Here is a RFID Privacy Advocate, Dr.Katherine Albrecht. This is part 1 of a 3 part video.  She may seem alarmist at times, however she understands this technology extremely well, and there is nobody better at seeing the consumer-side of the industry. She is the unofficial watch-hawk of the industry. If you have limited time, start watching this video at 6:40.

When considering the rest of this article, one must remember that Passive RFID Technology doesn’t need to be hacked, it was designed to be completely open. A  reading and cloning of the pass information is all it takes.

Regarding some cloning and security concerns Wikipedia states (RFID, Safety Concerns), “Other cryptographic protocols attempt to achieve privacy against unauthorized readers, though these protocols are largely in the research stage. One major challenge in securing RFID tags is a shortage of computational resources within the tag. Standard cryptographic techniques require more resources than are available in most low cost RFID devices.”

Bruce Schneier speaks regarding the open source reading software at RF Dump.org:
“[Grunwald] is doing what RFID is supposed to do,” said security author and Counterpane Internet Security Inc. Chief Technology Officer Bruce Schneier. “This is serious. He didn’t hack anything. RFID technology originally was designed to be completely open; that’s its problem. He went to the spec, read it and followed it. If you query the chip, you will get this info. If there were security countermeasures on the chip that were thwarted, then we could talk about hacking.” Source: Computerworld USA 2004

I will give you a RFID scenario that will seem very beneficial. And indeed in itself it could be.
All the products that you purchase have an RFiD chip placed in the package. And you have a kitchen with shelving and refrigerator which have RFiD readers built-in.

Getting ready to create a grocery list? You use your Kroger/Safeway/Grocery Store Tablet PC app. You simply push a button, and it inventories what you have and generates a shopping list for you. You print it out and take it to the grocery store, and the application prints your discount coupons to take to the store. Or perhaps you make an adjustment to your order push “SEND” and your order is whisked to the grocery store with all applicable discounts. When you arrive, your groceries are packaged and ready for you. You don’t even need your Credit card, because it is already linked to your iPad application. You just say thank you, and off you go. You love it.  Technology at its finest.

I could write several chapters on marketing strategies based off this relatively simple application of RFiD. Topics would include consumer adoption, consumer incentives, tiered shopper pricing, incentive pricing, impulse purchasing, preferred product placement, etc. When a person realizes grocery store margins are extremely thin. Stores make much of their money by selling grocery aisle “real estate” rather than by simply selling the products. And the large grocery stores also sell your buying data to third-party “partners” from purchases that you make on your “value/discount card”.

The “Marketing” Office – Parody –  This is fictional, entirely fictional. In no way possible could this conversation really taken place. Really, seriously, there is no way, really…..

Third-party partners don’t necessarily have to fall within the same industry, in fact many times they do not. For example, an Insurance company (Health, life, auto)… would want to know if you bought a case of cigarettes, beer or liquor every 3 days. Or if you participate in what some would call “risky” activities.  Such as skiing double-black diamond or terrain park runs all day long.

When a person truly understands the scope of the way data can be shared and interpreted I ask, “Can you see how the puzzle of your habits and lifestyle can be put together?” Companies say they are just looking to stratify you into a group, and there is no desire for them to identify you personally. However, the data allows them to if they wish. Your name, email, and social security number are just cells on a spreadsheet.

Ski and Ride free and untracked

The industries employing RFiD have incredible financial backing, and financial incentive to have you adopt the technology.

They control a much larger media machine than any individual opponent. Yet as an individual we do have the right (for now) to determine how we share our information. When I ski or ride I prefer to do it UNTRACKED, and leave an anonymous reminder of where I have been.

Summit Daily News Article 10-1-2010

Ski Pass Defender made the front page today! Our local paper, the Summit Daily News, published an article featuring SPD and the potential controversy among stakeholders.

There are two corrections to the article. 1) We did not invent it.  We did review more than 3 dozen and tested a dozen passholders to find the one which serves the skier and rider the best.  Though jacket scanning, pass security, and easy opening even with gloves were significant considerations. We asked to make a few modifications to the existing package.  Ski Pass Defender is the best evolution for snowsports, and it is made in the USA. We also believe the Patent pending Squeeze to Read design is second to none. 2) We will be including a 5/8″ lanyard and 2 credit card shielding sleeves  per Defender to each of our  previous, current, and future online orders ($12 value).

Summit Daily News Article 10-1-2010

(http://bit.ly/aimC71)